National Aeronautics and Space Administration 


NASA Case Study MSFC-CS1008-1 
By Lizette Kummer and Jennifer Stevens Rey. 12/12/16 


In the Hot Seat: STS-115 Lightning Strike Stand Down Debate 


“There is no way the PIC’s could have seen any current’ was the gist of Mike Griffin’s 
assessment. Griffin was the NASA Administrator at the time. The buck stopped at his desk. 
Holding a napkin out to Pat Lampton, Griffin showed Lampton the calculations he’d made over 
dinner that predicted that the Pyrotechnic Initiator Controllers (PIC’s) at the base of the Space 
Shuttle Solid Rocket Boosters (SRBs) were fine. A lightning strike the day before, the worst 
ever experienced with a Space Shuttle on the launch pad, caused a halt to the launch count down 
as technicians, engineers, and managers scrambled identify any damage to the launch system. 


SRB technicians and engineers assessed the data against their Lightning Strike Re-Test 
Requirements, determining that all but one of the requirements could be checked if they resumed 
the countdown. For the one remaining requirement, testing the integrity of the PIC’s would 
require 96 hours to set up, test, and reassemble. The engineers were convinced that there was no 
way to do calculations to show the PIC’s were okay. The only option was to stand down. 


It was SRB Deputy Project Manager (PM) Pat Lampton’s responsibility to decide what the 
SRB project position needed to be to certify that their hardware was safe to fly. He had to 
communicate that decision to the Mission Management Team (MMT) as a Go or No Go position 
to resume the count down. If the answer was Go they could still meet a delayed, but acceptable 
launch schedule. If the answer was No Go, rescheduling the launch would be a grueling 
shuffling of hardware, personnel, and mission timelines to accommodate Russian missions to the 
Space Station, supplies for the launch, and personnel manning launch operations. On top of that, 
Hurricane Ernesto was spinning off the coast of Florida, threatening the need for the Shuttle to 
roll back to the hangar if they waited too long. 
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Ordinary and Extraordinary Delays 


Space Transportation System (STS)-115 held crew and cargo bound for the International 
Space Station (ISS). Following an acceptable Flight Readiness Review (FRR) ending August 15, 
2006, the STS-115 mission was scheduled to launch on Sunday, August 27. After a 2 2 year 
program stand down following the loss of Space Shuttle Columbia in 2003, and subsequent 
Return to Flight (RTF) launches of STS-114 and -121, STS-115 was poised to be the first 
“ordinary” Shuttle launch since the accident. 


Before Columbia, the Space Shuttle Program (SSP) had established a mission manifest, a 
time line of launch date targets, to complete the International Space Station construction by 
2010. Schedule delay from the Columbia accident resulted in a more aggressive schedule to still 
meet the 2010 completion date. Russian Soyuz (crewed) and Progress (cargo) missions bound for 
the ISS had inflexible launch dates that NASA had to schedule around. Launch windows to the 
ISS were also constrained by the location of the ISS relative to the launch site and other 
technicalities of orbital dynamics. Weather conditions were of significant concern. Significantly, 
strong winds from a hurricane or tropical storm would mean the vehicle would have to be rolled 
back to the Vehicle Assembly Building (VAB) for protection. Hurricane Ernesto presented such 
a danger. 


Shuttle operations required the terminal launch countdown to start several days before 
launch. In the countdown, there are built in “holds” where the clock stops to accomplish planned 
work or poll the various elements to determine their Go-No Go launch status. If Go, the clock 
starts ticking again. Some vehicle systems have time-dependent expiration of their certification. 
If delayed long enough, those systems have to be rechecked, and sometimes replaced (such as 
batteries). The clock for the certification expirations doesn’t stop for planned or unplanned holds. 
The lightning strike was an unplanned hold, and the certification criteria for the PIC’s had been 
exceeded. 


Stormy Weather 


Preparation work on STS-115 was proceeding on Friday, August 25, but was halted after 
noon for a severe thunderstorm — not an uncommon occurrence at KSC. In fact, the rollout to 
Launch Pad 39B was delayed for two days at the end of July because a storm near KSC could 
have generated lightning, which if it hit the Orbiter, could have caused “immeasurable damage”. ! 


At approximately 1:49 PM, the largest recorded lightning strike to date struck directly to the 
launch pad. Pouring rain obscured camera lenses, so it was unclear exactly where the lightning 
hit. The pad has lightning rods to protect sensitive systems, but lightning doesn’t strike in clean, 
singular pathways. Electrical current follows the path of least resistance, and can jump 


' Wikipedia, STS-115, https://en.wikipedia.org/wiki/STS-115 , accessed 4/29/16 
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unpredictably to other objects in the vicinity of the strike. At the time of the strike, the Orbiter 
was powered on and the SRB systems were off. 


In the event of a lightning strike to the pad, certain contingencies in the countdown sequence, 
documented in the Operational Maintenance Requirements and Specifications Document 
(ORMSD), require that systems be evaluated to determine if they have sustained any damage. 
Ground crews began to do a pad walk down after the storm subsided as required. Spaceflight 
Now reported, “The spike in the shuttle electrical system was very small and within allowable 
limits. But no such spikes were expected, .. prompting engineers to question whether it might 
have caused any problems. At the same time, telemetry indicated a spike in the circuitry 
associated with a pyrotechnic device that releases a hydrogen vent arm from the side of the 
shuttle's external tank at liftoff. Engineers inspecting the pad later reported a burning smell in the 
area of the gaseous hydrogen vent arm, but no obvious signs of damage were seen.”” 


The launch was delayed for 24 hours 
by LeRoy Cain, the MMT chairman and 
KSC director of shuttle integration, so 
that engineers and technicians could 
inspect the systems and perform any tests 
or analyses required. The MMT was 
scheduled to convene at 4:00 PM on 
Saturday, August 26 to discuss each 
element’s status and readiness to resume 
the countdown. 


Figure 1 The only imagery of the lightning strike at Launch Pad 39B 
on 25 August 2006 with STS-115 on the pad 


Hot Seats 
PIC Your Failure 


Pyrotechnic Initiator Controllers (PIC’s) are used during separation sequences to set off the 
pyrotechnic charges that sever certain components connecting shuttle elements to each other or 
the launch pad. If a component fails to sever, unexpected forces can be relayed between still - 
connected components, causing catastrophic damage or putting the vehicle off its planned flight 
path. The damage could result in loss of mission, loss of hardware, or loss of life. Pyrotechnic 
systems must operate. 


SRB PIC’s were located in the aft skirt at the base of the launch vehicle. Eight large bolt-like 
studs held the entire Space Shuttle vehicle to launch pad through the hold down posts, secured 
with frangible nuts. Six seconds after the Space Shuttle Main Engines (SSMEs) ignited and at the 
moment the solid rocket motors ignited, pyrotechnic charges were activated, shearing the nuts in 
half, and liberating the vehicle from the pad. If one of the charges did not blow, one or more of 


? Harwood, William, Lightning delays Atlantis launch a day, Spaceflight Now 
https://www.spaceflightnow.com/shuttle/sts1 15/060826delay/, accessed 21 June 2016 
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the eight studs would not let go. At that point, Lampton worried, they “didn’t know if that would 
make a difference, or if the vehicle would head to Daytona Beach.” 


NASA Standard 
Detonator (NSD) for 
Booster Cartridge (2) 
8 Holddown Post 
Astembiles par Fight Set 


Mobile Launch 
Platform (MLP) 
Support Post 
Figure 2 Space Shuttle Hold Down Post Location; Aft Skirt attach point; 
and Hold Down Post Components 


Photo and graphic credit: NASA 


Figure 3 Cross section of the Hold Down Post showing 
the Detonation Charges Initiated by the PICS, which are 
located inside the Aft Skirt; Graphic credit: NASA 


a 


Figure 5 Frangible Nut on the Hold Down Post with PIC 
lines attached Photo credit: NASA 


Figure 4 Frangible Nut after pyrotechnic severance 
Photo credit: NASA 


Contention in the MMT 


As soon as the lightning strike hit, newly named SRB Deputy Project Manager Pat Lampton, 
worked with his engineering team to assess the requirements described in the OMRSD and the 
probable health status of the boosters. Out of the required health tests for Booster, seventeen are 
for pyrotechnics. Sixteen of them could be conducted during in the current stand down. One of 
the seventeen OMRS requirements for testing the integrity of the PIC’s would require 96 hours 
to set up, test, and reassemble. Video imagery was indeterminate. The booster systems were 
powered off, meaning they had no sensors operating to determine the health of the components. 
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The strike “might have affected circuitry that fires the explosive charges used during booster 
ignition and separation’”?, which may also have affected the booster’s self-destruct system. 
Consolidating the information, the SRB Chief Engineer and engineers recommended a No Go 
vote. The only option for assuring crew safety, according to the engineers, was to stand down 
and perform the required test. 


As the MMT convened around 4:00 PM Saturday, August 26 to discuss the potential 
impact of the lightning strike on all the elements (project offices, ground ops, weather, 
integration, etc.) were Go for launch except SRB. Representing the Booster Project on the 
MMT, Pat explained they did not have sufficient data to ensure the PIC’s were operational. 
Other elements of the Shuttle had similar issues, but had determined they could test the health of 
their systems in existing planned system checks in the normal countdown procedure. Orbiter 
Project felt that since the Orbiter was powered on, they had sufficient sensor data to indicate that 
their systems were not affected by the lightning strike. SRB had no such data. Discussion 
challenging the validity of the SRB OMRS requirement and their engineering assessment 
ensued. 


According to Wayne Hale, such challenges were typical and valid MMT discussions. Pat 
repeated the No Go justification — simply, they did not have sufficient information to indicate 
that their system was not affected by the lightning strike, that the system was critical for the safe 
operation of the vehicle, and that the test was required to determine the integrity of the PIC lines. 
He could not justify writing a “waiver” to the requirement based on ungrounded analysis. He 
needed data. Lampton recalled that the challenges to the validity of the requirement and to the 
engineering assessment was intense. MMT members expressed opinions about the 
unreasonableness of the test. Hale even questioned the requirement. Lampton held the SRB 
position and explained the reasoning in detail. Several, including NASA Administrator Mike 
Griffin, ran simple engineering calculations, convincing themselves that electrical current could 
not have gotten to the aft skirts, much less penetrated them and affected the PIC’s. 


MMT discussions can be very aggressive in questioning analysis, requirements, and 
conclusions presented. Challenging engineering rationale is healthy and necessary to ensure 
issues are well vetted. The scrutiny can be intense. Wayne Hale, then SSP Program Manager, 
stated it this way, “There is always some back and forth. ..In the old days, maybe, they ha[d gone 
to the extent] of what would be considered brow beating, but not this time.” After Columbia, 
Hale had ordered MMT members to undergo an intense series of training to address CAIB 
concerns of communication disconnects. But, Hale recalled, “[there was still an attitude that] it’s 
a mature system, we’ ve operated it for 20 years, we'll get no new surprises.” 


Hale noted that “some of the senior management was trained under former Marshall Space 
Flight Center Director Bill Lucas. Lucas had said, ‘MSFC will never hold up a launch’... That 
was his attitude at the time of Challenger... Lucas was famous for that statement.” Hale 
continued, “Before Columbia, you really had to present clear and present danger to stop the train 


3 Harwood, William, Solid rocket booster tests could be ordered, Spaceflight Now, 
https://www.spaceflightnow.com/shuttle/sts1 15/060826srbtest/, accessed 23 June 2016 
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in those old days.” After Columbia, Hale generalized, “they had really toned it down; they had to 
keep it civil. Columbia was always on their mind. They tried to never issue waivers and 
deviations.” Still, many mangers raised in the old system felt, from their personal engineering 
judgment, that the lightning strike was not close enough to the aft skirt to have affected that 
system. Lampton commented that the MMT Chair, Leroy Cain, kept repeating “You can’t fly 
because you don’t have data that says you meet the requirement’, but that the logic of the 
statement didn’t seem to make sense to him given the evidence. All the other Elements were Go 
for launch, why not SRB? After several hours, Cain called a recess for dinner. 


Necessary Breaks 


During the break, Lampton recalls that Bryan O’Connor, the head of Safety and Mission 
Assurance (S&MA) approached him and told him, “If you’re No Go, I’m No Go.” O’Connor and 
Chris Scolese, then NASA Chief Engineer, sat at Cain’s left at the table, and would be the last 
MMT members to register their Go/No Go vote.* The show of support renewed the new Deputy 
PM’s commitment to the engineering recommendation. 


After dinner, Griffin handed Lampton the famous napkin with the simple Faraday cage 
calculations showing that the potential for effects to the PIC’s were unlikely. “Yes, we’ve all 
done that calculation in high school physics, but what are your assumptions?”, Lampton recalls 
responding. How did he know lightning only hit at the top of the service mast where the 
lightning rod was? How did he know it didn’t jump to the boosters? What was the voltage or 
current at the different locations? It wasn’t that they couldn’t do physics calculation. They didn’t 
have justifiable numbers to put into the calculations. 


Engineering Operations 


For the most part, everyone sitting at the table was an engineer of some sort. They had the 
same engineering training. However, there was a difference, Hale recalls, in the perspective 
about Go/No Go decisions. Hale, Cain, and Deputy SS PM John Shannon were all “Ops” guys. 
“Tt’s always about the clock in Operations”, said Hale. “Engineering is more tradition, more 
deliberative.” Hale also suggested that some people, such as Griffin and himself, didn’t need a 
lot of data in order to make a decision. Their challenge was in having the patience to “allow 
other people to catch up.” As a former flight director, Hale was always mindful of the limitation 
of food, water, and timing of operations on the ISS. Deliberation is not as useful in the mission 
operations directorate (MOD) as it is in Engineering. 


4 Tn the FRR for the flight before STS-115, STS-121, Both Scolese and O’Connor registered a dissenting opinion 
(we No Go) for the flight. At that FRR, Mike Griffin overrode the No Go recommendation, and approved going for 
launch. The circumstance in that case was different. The External Tank (ET) felt they couldn’t analytically predict 
that foam would not fall off the ET. Scolese andO’Connor couldnot certify that the Orbiter would not be hit, and if 
it were hit, they could not accept the responsibility for the loss of the Orbiter. Contingency measures were in place 
to rescue the crew, but the Orbiter would be lost, at a high dollar cost to the program. Only Griffin had the authority 
to risk losing such an expensive piece of hardware, and its attendant capability. 
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Although it is typical to challenge the validity of requirements, persistent questioning 
throughout the night became an increasingly unproductive discussion. Robert Wright, the United 
Space Alliance avionics lead, with decades of experience with PIC’s stood near the wall behind 
Lampton. Wright had written and approved the OMRS requirements and knew the system 
thoroughly. As he stood silently behind Lampton throughout the night, arms folded across his 
chest, he watched and waited to see what Lampton would do. Lampton saw him there. Lampton 
held his ground. 


Impasse 


At 2:00 AM Sunday morning, after 8 hours of deliberations, Cain called for a recess to the 
discussion. The discussion was going in circles and no new information or understanding was 
coming to light. Lampton requested a 7 hour break, hoping to reconvene no earlier than 9:00 
AM. Griffin recommended that they reconvene at 7:00 AM — 5 hours from the time they 
dismissed. Given the driving distance to homes and hotels, Hale intervened, stating they would 
come back at 10:30 AM. In Hale’s view, coming back after 2 hours of sleep could be worse than 
continuing through the night. The MMT itself would reconvene at 6:00 PM on Sunday night, and 
Lampton needed to have rationale then, or a final No Go vote. 


Although Wayne was not chairing the MMT at that time, he made a command decision to 
clarify what was needed when everyone came back. Hale summarized the problem back to Pat 
at 2:00 AM Sunday morning in this way “So what you’re saying is, that you have a requirement 
in the OMRS that you don’t have data to satisfy?” Lampton recalled Hale said something like, 
“Pat doesn’t need to know why he has a bad (OMRSD) requirement. Pat needs information so 
that he can justify why he meets the requirement for the PIC’s. When you come back at 10:30, 
all of you are going to give all the information that you have to SRB so Pat can find the rationale 
he needs to be able to launch.” 


STOP AND THINK 


What needs to be done when they come back at 10:30 AM in order to have flight 
rationale by 6:00 PM? 


From Lampton’s perspective 


From Cain’s perspective 


From Hale’s perspective 


From Griffin’s perspective 
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The Rest of the Story 


At 2:00 AM Hale had asked all members of the management team to exhaust all sources of 
data and give it to Lampton when they came back later that morning. At 10:30 AM the data 
started coming in from his booster team, and people from all the other elements. What they 
found was “reams and reams of imperfect data.” Everyone brought data except the ground ops 
people, who had so much data they couldn’t make sense of it all. The E3> team (lightning strike 
experts) came in and explained that a lightning strike occurs in a nanosecond and that the sensors 
on which the management team (i.e., all the other elements) relied to capture the impact of a 
lightning strike on their systems were not sensitive enough to capture or measure lightning strike 
data. The sampling rate was too low to sense a transient that fast. 


After about 2 hours, ATK’s Cary Ralston came up with an idea for how they could have 
confidence the PIC’s were okay without having to go through the 96-hour PIC test. Ralston’s 
solution involved the 400 thermocouple gages glued to the exterior of the Reusable Solid Rocket 
Motors (RSRMs), an element integrally tied to the SRB hardware. The off-the-shelf, unshielded, 
non-de-rated thermocouples arrayed across the outside of the motor to measure hardware 
temperature are far more sensitive to electrical transient surges than the shielded and de-rated 
PIC’s sheltered inside the thick aft skirt. Before and after the lightning strike all 400 
thermocouple sensors were actively working. The logic was that if a lightning strike had 
impacted the booster then some or all the sensors would not be working. Because the aft skirt is 
connected to and below the motor, the Booster PIC’s were not impacted. Pat did the other 16 
health tests on the pyrotechnics and they showed okay. The flight rationale on Boosters would be 
based on arisk assessment, not testing. 


The rationale was vetted through the whole Mission Management Team and up through the 
agency. Before the MMT reconvened at 6:00 PM on Sunday, August 26, Lampton started 
briefing various groups on Booster’s flight rationale. Lampton commented that David Martin, the 
SRB PM, gave him advice for building consensus for the rationale. Martin counseled Lampton to 
talk the rationale through with the engineers such as the E3 members that supported higher level 
managers. Those managers needed to agree with the rationale before the MMT did. Lampton 
found this approach to consensus building wise. 


Lampton noted that for the Sunday night briefings the SRB flight rationale was based on new 
data gained that morning, not from the discussion started the day before. The final rationale 
required the new data and approach. That Sunday morning, said Lampton, “the health of the 
pyrotechnics [was] not based on the capacitor®.” Of the relationship of the motors to the booster, 
Lampton noted, “essentially, the data on the RSRM is canary data, like the canary in the mine. If 
the data from the thermocouples is okay, then the rest of the booster below that is okay.” 


> Electromagnetic Environmental Effects Team 
6 A capacitor is acomponent of the pics that would have been compromised by the lightning strike 
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At 2:00 PM Lampton presented the rationale on a telecon to the Booster PM (Martin), and 
Engineering and S&MA managers. The phone lines were open, so Pat suspects that other people, 
such as other MMT members were listening in on their discussion. Pat went through the 
reasoning on the rationale and got concurrence from Engineering, his PM, and S&MA. At 6:00 
PM, Pat presented his new flight rationale to the MMT. The other Elements also presented 
modified flight rationale; after hearing SRB’s assessment and reviewing their own systems’ 


abilities to record the electrical spike from the strike, they recognized their flight rationale for the 
first go around was incomplete. 


Ultimately, “the decision was made to postpone the launch for another 24 hours, making the 
earliest possible launch date [Tuesday] 29 August 2006, still unassured that there was no damage 
from the lightning strike and taking into account the possible threat from Hurricane Ernesto.”’ 
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Figure 6 Space Shuttle Atlantis launches on STS-115 September 9, 2006 
Photo credit: Scott Andrews, NASA 


7 Wikipedia, STS-115, https://en.wikipedia.org/wiki/STS-115 , accessed 4/29/16 
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APPENDIX A: Time Line 


Thursday, Aug. 24, 2006 
Countdown begins (3-day count) 


Launch Sunday August 27, 2006 at 4:29 PM EDT (scheduled) 
Friday, 25 August 2006, a direct lightning strike hit the lightning rod atop the launch pad 
Leaving the L-2 in a storm, lightning struck the Pad Mast 
Orbiter was powered on 
Booster was powered down 


Saturday, August 26, 2006 
Pad Walkdown early morning — Team found strong discharge/burnt odor/vent arm PIC 
Convene MMT 4:00 PM — to decide go back and bring re-test or flight rationale and plan for 
retest 
Slip flight to Monday, August 28, 2006 4:04 PM EDT 
All elements GO except Booster is No Go due to inability to complete OMRSD Lightning Retest 
requirements — No rationale for waiver 
MMT debates rationale until 2:00 AM Sunday morning 


Sunday, August 27, 2006 
Project teams convene at 10:00 (10:30?) AM 
Meet with SRB team and experts from other elements to develop rationale 
Developed rationale to waive testing requirements on low likelihood evidence, large pile of 
imperfect information 
Briefed SRB Project Manager at 3:00 PM 
Briefed Propulsion Deputy/MSFC Engineering at 4:00 PM 
MMT Special Session at 6:00 PM; Wavier rationale developed and briefed 
Go for Launch on Tuesday, August 29 pending weather 


Monday, August 28, 2006 
Weather brief on path of Hurricane Ernesto and decision to roll back for cover 


Later: Weather briefing changed to favorable. Ernesto changed direction and headed out to sea. 
Decision to roll back to pad mid-way between rolling from pad to VAB. Violated speed limits 
also in rolling back to pad. 


Later: Launch scrub because of ECO sensor failure 


Later: Launch of STS-115 
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APPENDIX B: Post-Columbia Procedural Changes 


MMT Training 


The Columbia Accident Investigation Board (CAIB) observed that the decision making 
process of the Space Shuttle Program, and especially the MMT, was not thorough enough in 
vetting engineering issues in time constrained, high consequence settings, such as a launch scrub 
and turnaround. As the newly named SS Program Manager, having replaced Ron Dittemore, 
Wayne Hale was responsible for changing the culture. The program had many outside observers, 
such as the Return to Flight task group, GAO, and even congressional staffers who were looking 
over their shoulders to make sure they actually made the changes needed. Such changes were 
identified as contributing to the loss of the Challenger in 1986, and it was obvious that by 2003 
the needed changes were not made. Hale stated, “pretty much anything anyone suggested for 
training, we did. Some of it may have been over the top.. some changes needed, even some not 
needed.” 


Changes other than Training 


In addition to culture changes regarding the means and methods for vetting flight rationale at 
the MMT, changes were made to the attitude towards waivers and deviations. The attitude 
became to try never to issue waivers and deviations. 


Hale also suggested that flight operations does attract people who make decisions faster and 
don’t need a lot of data to justify a decision. People like Mike Griffin are “a quick study’, others 
around the table are slower. The quick studies need to allow those who are more deliberative or 
not as quick time to catch up because you need people to understand the issues. He commented 
that there would be diversity in the MMT and that MMT members needed to learn how to deal 
with that and manage the diversity, manage their approaches to satisfy the needs of the diverse 
perspectives and methods. 


Hale had the MMT room at JSC refurbished, making it bigger, with a bigger table, more 
chairs, audio-video teleconferencing capabilities, and posters hung up around the room to remind 
MMT members of the consequences of poor decisions made on time versus right decisions made 
after launch delays. The posters also included a synopsis adopted from the FAA on an error 
chain, which if broken, can reduce the likelihood of failures. Those posters are contained in 
Appendix C. 


Hale recognized that he, Cain, and John Shannon all shared the same flight operations 
background, that their thought processes were alike. He deliberately brought in others, like Kim 
Doering and Lucy Krantz to provide different backgrounds and different perspectives. 


Systems Engineering and Integration was greatly changed after Columbia. Before Columbia, 
it was a “small and unhappy group” because they could not do much. They only had about 10% 
of the people before Columbia as they did after Columbia. 
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APPENDIX C: Posters from the MMT Rooms 


REMEMBER 


“You will never remember the many times the launch slipped, 
but the on-time failures are with you always.” 


Walt W. Williams, X-15 Program Manager, Project Mercury Program Manager, July 27, 1963 
Quoted in “Failure is Not an Option” by E. F. Kranz 


“OPERATIONAL 


1. 


7. 
8. 
9. 


FAILURE TO MEET OPERATIONAL GOALS 
UNDOCUMENTED PROCEDURE 


DEPARTURE FROM DOCUMENTED 
PROCEDURES . 


VIOLATING MINIMUMS OR LIMITATIONS 
NO ONE FLYING THE SHUTTLE 


NO-ONE LOOKING OUT THE WINDOW 
OR WATCHING THE SYSTEMS 


COMMUNICATION 
AMBIGUITY 
UNRESOLVED SYSTEMS FAILURES 


“0. PREOCCUPATION OR DISTRACTION 
de 


CONFUSION 


12. INCREASE IN NEGATIVE COMMENTS 


ERROR CHAIN 


FOR MANNED SPACEFLIGHT 
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INGINE Oa 


OF SPACECRAFT DESIGN 
Engineering is done with numbers. Analysis without numbers is only an opinion. 

Not having all the information you need is never a satisfactory excuse for not starting the analysis. 
Space is a completely unforgiving environment. If you screw up the engineering, somebody dies 
(and there's no partial credit because most of the analysis was right...) 

David Akin is Associate Professor, Space Systems Laboratory Director at the University of Maryland 


ABILENE PARADOX 


“People in groups tend to agree on courses of action 
which, as individuals, they know are stupid.” 
Lynn Ashby, Houston Post 
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